Evidence Collection
Evidence Collection is where you create governance profiles and record evidence for them. Each governed agent has one profile. The profile holds the agent's risk level, the frameworks it is tracked against, the evidence in eight categories, and a sign-off (attestation) for each category.
Enterprise feature. Open it from Governance → Evidence Collection. Viewing needs the Evidence Collection read permission. Creating a profile needs write access to agent profiles, and filling evidence needs write access to Evidence Collection. Built-in roles with write access are Owner and Security & Compliance. See Compliance.
The Evidence Collection list
The cards at the top describe the whole project:
| Card | Meaning |
|---|---|
| Agents Assessed | Agents with a governance profile |
| Avg. Coverage | Average evidence coverage across those agents |
| Active Alerts | Open drift alerts |
| Attestations Signed | Category sign-offs completed across assessed agents |
The table lists one row per profile with Agent Name, Risk Level, Coverage, Framework Compliance, Drift Alerts and Last Updated. Search by agent name, and filter by Risk Level, Framework and Drift Alerts (All Alerts, With Alerts, No Alerts). Advanced Filters adds a Coverage Range.
Each row's menu offers Submit for Review (or Resubmit Changes after changes were requested) and Delete Governance Profile. Select a row to open the agent's compliance profile.
Coverage is the share of the evidence form that is filled in, across all eight categories.
Create a governance profile
Add the agent
Select Add Agent. Under Select Agent, pick an agent. Only agents that have sent traces and do not have a profile yet are listed.
Set the risk classification
Choose the EU AI Act risk level: Unacceptable, High, Limited or Minimal.
Choose frameworks
Under Compliance Frameworks, select EU AI Act, ISO 42001 and NIST AI RMF as needed. EU AI Act is selected by default. You can change the risk level and frameworks later with Edit Governance Profile.
Choose who fills the evidence
Select Create Governance Profile. Under Next Steps, choose:
- Assign to Developer: send an evidence request through Slack, Jira or Linear. The request goes to the Slack channel, Jira project or Linear team mapped to this agent in Project Settings → Integrations. If the integration is not connected or the agent is not mapped, the page links you to set it up. The request then waits in Available Requests for someone to accept it. See Requests & Review.
- Fill Evidence Myself: open the evidence form straight away. The request is created without a notification and does not appear in Available Requests.
The evidence form
The form has one section per category. A progress indicator shows how much of each category is filled. Each section ends with an attestation checkbox, for example Use Case & Scope Attestation: "I confirm that the above information accurately describes the AI system's use case, scope, and deployment regions." Saving the form saves the attestations and records who signed each one and when.
| # | Category | Fields |
|---|---|---|
| 1 | Use Case & Scope | AI Use Case Name, Business Purpose, Owning Team / Department, Secondary Use Cases, End User Type, Estimated User Volume, Deployment Stage, Geographic Scope, Prohibited Uses |
| 2 | Risk Classification | EU AI Act Risk Level, EU AI Act Annex III Category, Automated Decision-Making Level, Fundamental Rights Impacted, Impact Severity, Legal Consequences Possible, Vulnerable Groups Affected, Risk Assessment Date, Risk Assessor, Risk Assessment Document |
| 3 | Data Governance | Training Data Documented, Training Data Sources, Training Data Consent Obtained, Inference Data Sources, PII Categories Processed, PII Minimized, PCI Data Collected, PHI Data Collected, Data Minimization Practices, Data Anonymization Applied, Data Owner Assigned, Data Owner, Data Owner Email, Data Retention Period, Data Deletion Process Exists, Data Deletion Process, Encryption at Rest, Encryption in Transit, DPIA Required, DPIA Completed, DPIA Document URL |
| 4 | Human Oversight | Oversight Model, Human Review Required, Human Review SLA, Override Capability, Override Mechanism, Kill Switch Enabled, Kill Switch Location, Escalation Workflow, Oversight Frequency, Human Interventions Logged, Intervention Log Location |
| 5 | Security & Abuse Prevention | Prompt Injection Protection, Protection Mode, Output Filtering, Abuse Detection, Jailbreak Detection, Jailbreak Testing Performed, Data Leakage Prevention, Rate Limiting, Requests per Minute, Requests per Day, Incident Response Plan Defined, Incident Response Plan URL, Security Contact Name, Security Contact Email |
| 6 | Bias & Fairness | Bias Assessment Completed, Bias Test Date, Bias Metrics Used, Bias Test Results Document, Protected Attributes Tested, Fairness Metrics Defined, Fairness Threshold Defined, Fairness Threshold, Performance Metrics Tracked, Performance Benchmarks Defined, Disparate Impact Assessed, Disparate Impact Mitigation Strategy |
| 7 | Transparency & User Rights | AI Disclosure Provided, AI Disclosure Text, Disclosure Method, Explainability Provided, Explainability Level, User Feedback Enabled, Opt-Out Available, Opt-Out Mechanism, User Data Access Process, Right to Object Process, Human Review Available on Request, Model Card Published, Model Card URL |
| 8 | Legal & Accountability | Legal Owner Assigned, Legal Owner, Legal Owner Email, Compliance Owner Assigned, Compliance Owner, Compliance Owner Email, Legal Approval Obtained, Legal Approval Document URL, Applicable Regulations, Regulatory Filing Required, Regulatory Filing Completed, Terms of Service Exists, Terms of Service Last Updated, Liability Defined, Liability Type, Insurance Coverage, Change Management Defined, Change Management Process, Model Updates Logged, Model Update Log Location, Audit Trail Enabled |
Risk Assessment Document and Bias Test Results Document record the selected file's name only. The file is not uploaded or stored in ANTS Platform. Keep the document in your own document store and use the name or the URL fields to point to it.
How evidence is used
- Framework coverage: a framework requirement is complete when its evidence category is 100% filled and the category's attestation is signed. See Framework Coverage.
- Detection policies: when the evidence is approved, some answers configure the agent's AI Guardrails Scheduled Detection policy. See What approval configures.
- Drift: declared answers in Data Governance, Security & Abuse Prevention and Bias & Fairness are compared with detections from the agent's traces. See Drift Alerts.
The agent's compliance profile
Select an agent in the list to open its Agent Compliance Profile. It shows:
- Coverage, Attestations signed, open Drift Alerts and Last Updated, with Submit for Review when the evidence is a draft.
- Framework compliance for each selected framework, requirement by requirement.
- Runtime Validation: for PII Detection, PCI Processing, Output Filtering, Abuse Monitoring, Safety Detection, Bias Monitoring and Error Rate, the declared value next to the value observed in the last 7 days, with a status of Match, Drift or Not Monitored. Not Monitored means AI Guardrails has not scanned the agent's traces for that category.
- Open drift alerts for the agent.
- The evidence, category by category.
Next steps
- Requests & Review: accept, submit, review and approve evidence.
- Framework Coverage: see which requirements are complete.
- Drift Alerts: how declared evidence is checked against runtime behavior.